{"record":{"id":"ab975d2af3f441e1","repo":"puppetlabs/puppet","slug":"role-names-must-be-provided-not-numbers","errorCode":null,"errorMessage":"Role names must be provided, not numbers","messagePattern":"Role names must be provided, not numbers","errorType":"exception","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/type/user.rb","lineNumber":527,"sourceCode":"    # (see Puppet::Settings#service_user_available?)\n    #\n    # @return [Boolean] if the user exists on the system\n    # @api private\n    def exists?\n      provider.exists?\n    end\n\n    newproperty(:roles, :parent => Puppet::Property::List, :required_features => :manages_roles) do\n      desc \"The roles the user has.  Multiple roles should be\n        specified as an array.\"\n\n      def membership\n        :role_membership\n      end\n\n      validate do |value|\n        if value =~ /^\\d+$/\n          raise ArgumentError, _(\"Role names must be provided, not numbers\")\n        end\n        raise ArgumentError, _(\"Role names must be provided as an array, not a comma-separated list\") if value.include?(\",\")\n      end\n    end\n\n    # autorequire the roles that the user has\n    autorequire(:user) do\n      reqs = []\n\n      roles_property = @parameters[:roles]\n      roles = roles_property.should if roles_property\n      if roles\n        reqs += roles.split(',')\n      end\n\n      reqs\n    end unless Puppet::Util::Platform.windows?\n","sourceCodeStart":509,"sourceCodeEnd":545,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/type/user.rb#L509-L545","documentation":"Raised by the validate block of the `roles` property (a Puppet::Property::List with :required_features => :manages_roles) on the `user` type. Roles are RBAC role names, not numeric IDs; any member matching /^\\d+$/ is rejected. The property is only usable with providers declaring manages_roles (Solaris user_role_add, Windows ADSI).","triggerScenarios":"`user { 'alice': roles => ['10'] }` or `roles => '10'` on Solaris with the user_role_add provider, or on Windows via ADSI groups-as-roles; RBAC data exported as numeric role IDs from a CMDB.","commonSituations":"Converting Solaris `usermod -R` scripts or roleadd outputs into manifests; ID-based identity management exports; the property silently not being supported on plain Linux useradd is a separate feature error, this one fires when the value format is numeric.","solutions":["Pass role names: `roles => ['sysadmin']`","Create the roles themselves with the `role` type on Solaris and reference them by name","Fix the data source to export names, not numeric IDs"],"exampleFix":"# before\nuser { 'alice':\n  ensure => present,\n  roles  => ['10'],\n}\n\n# after\nrole { 'sysadmin': ensure => present }\nuser { 'alice':\n  ensure => present,\n  roles  => ['sysadmin'],\n}","handlingStrategy":"validation","validationCode":"bad = roles.select { |r| r.to_s.match?(/\\A\\d+\\z/) }\nraise ArgumentError, \"roles must be names: #{bad.inspect}\" unless bad.empty?","typeGuard":"def role_names?(list)\n  list.is_a?(Array) && list.all? { |r| r.is_a?(String) && !r.match?(/\\A\\d+\\z/) && !r.include?(',') }\nend","tryCatchPattern":null,"preventionTips":["Export RBAC data as names from the CMDB","Define Solaris roles with the role type and reference them by name","Add data tests (rspec-puppet tests on catalog) for numeric role entries"],"tags":["puppet","user-resource","solaris-rbac","roles","argument-validation"],"backgroundTag":"numeric-id-instead-of-name","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}